RPC Remote Procedure Call - followed by reboot

  • Thread starter Thread starter Nigel Andrews
  • Start date Start date
N

Nigel Andrews

My laptop is repeatedly rebooting after a RPC message appears.
I cannot start in Safe Mode and nor can I boot to the WinXP CD and use the
console to access the disk as it reboots when I select the Recovery Console.

Can anyone suggest how I can get around this?

Thanks
Nigel
 
Nigel Andrews said:
My laptop is repeatedly rebooting after a RPC message appears.
I cannot start in Safe Mode and nor can I boot to the WinXP CD and use
the console to access the disk as it reboots when I select the Recovery
Console.

Can anyone suggest how I can get around this?
Click to expand...

If this article applies, you're running an unpatched system for years.
http://www.web-antix.com/blaster.html
 
Thanks for that.
It may well be the patch hasn't been installed. I see the laptop still only
has SP1!
I have run the Symantec scan tools for Sasser and Blaster and they come back
negative

I was prompted to install a patch by the Blaster check
Microsoft Security Bulletin MS03-026
Buffer Overrun In RPC Interface Could Allow Code Execution (823980)
but after running part way thru' it said it could not install catalog files.
Is this the patch that you were pointing me to?

Incidentally the link on that Symantec site to an MS patch is invalid.

Thanks again
Nigel
 
Thanks for that extra.

Unfortunately now I can't run anything such as the MSRT, as once the RPC
shows, even tho' I do 'shutdown -a' to remove it temporarily, I cannot click
anything afterwards!
The cursor changes to an hourglass over the Start button and task bar and
any icon I can click does nothing or windows show 'Not responding'.

I don't know what I did before that allowed me to run things and just do a
'shutdown -a' every now and then to keep the RPC at bay.

Very annoying.

Thanks again

Nigel
 
I still have a DOS window which works but I cannot run anything from it,
just DIR etc.

Also I note that despite the RPC not being up a System Shutdown is still
showing on the task bar.


N
 
Nigel Andrews said:
Also I note that despite the RPC not being up a System Shutdown is
still showing on the task bar.
Click to expand...

See if you can manage this procedure within that time frame:
Start > Run: services.msc > Remote Procedure Call (RPC) > doubleclick >
Restore tab > replace "Restart Computer" with "No Action" in all three
cases (translated on-the-fly). Make also sure to enable the SP1 firewall
on Internet connections. Otherwise, your system will get infested again
and again. Apply that removal tool when done.
 
Thanks again.

I was able to get those 3 settings in and the RPC does not now appear BUT
the error message before, "Generic Host Process for Win32 Services has
encountered a problem..." does still show.
I seems that shortly after that appears the problems still occur i.e., I
cannot run anything new. I managed to double click the removal tool and it
appears just to start unpacking and then I see nothing more so I assume that
gets stopped too.

It maybe I have to go for a re-install, but I keep thinking there must be a
way to get into this thing.

Thanks again
Nigel
 
Nigel Andrews said:
I was able to get those 3 settings in and the RPC does not now appear
BUT the error message before, "Generic Host Process for Win32 Services
has encountered a problem..." does still show.
Click to expand...

Sure, the Blaster/Sasser worm/s still crash that RPC service. The target
of that procedure above was simply to avoid the resulting restart in
order to run the removal tool.
I seems that shortly after that appears the problems still occur i.e.,
I cannot run anything new. I managed to double click the removal tool
and it appears just to start unpacking and then I see nothing more so I
assume that gets stopped too.
Click to expand...

You may or may not see the tool's report in %windir%\Debug\mrt.log
It maybe I have to go for a re-install, but I keep thinking there must
be a way to get into this thing.
Click to expand...

See the log file above and reboot. If the problems persist, you might
save a lot of time when installing Windows from scratch. Make sure to
install SP2 and the latest security updates prior to going online.
 
Thanks again.

I mustn't 'overdraw' on your kind help.
I seem to have so little time to get anything started before the 'crash'
stops anything.

If the MSRT did complete running, then it doesn't seem to have worked
because rebooting gets the same messages and problems.
But I don't think it got enough time to complete running.

I did wonder if I can stop certain things running in the first place, so
that it doesn't get to crash and therefore maybe I can have more time to run
stuff?

I am getting closer to the format and reinstall and I will certainly get SP2
installed and AV and Firewall before connecting to the Net.

Thanks again
Nigel
 
Nigel Andrews said:
I am getting closer to the format and reinstall and I will certainly
get SP2 installed and AV and Firewall before connecting to the Net.
Click to expand...

Well, these worms are usually rather easy to remove in contrast to most
trojans. Therefore, it was worth to try. Anyway, since you experience
these problems - yes, format the system and perform a clean install.
Thanks again
Click to expand...

You are certainly welcome, Nigel.
 
Back
Top